agenttesla | 499d0e04aeabb42bfa3d686bc65b45b3b116116cf9231ea2717569e44dcfc8de

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order confirmation for PO 7UH2025.exe
Size

549KB
MD5

f61aec6b837c52490e5af74f2558decd
SHA1

90d0c4a77384dcfb04b27f66a889e8bb627ff06c
SHA256

9c0ad5329e00794b6b9591cf7f4f633cd2d0e3d1209d50b99cb48838fe63b79a
SHA512

c8cadeef5cf02efbfa34df770063a78b82ff2ca5280bb0b47f85e41e9609c3978ec88cc4ddb6cf2fc7fbbad0547215ef3c61f7721e1c66315061ec2ee8ec17fd
SSDEEP

12288:2pzQijkXRZXMnWJsGQkHgQ0cNrSdSG774u4U4U4U+H0U4H0U4UjU+J4J4H4f4D4z:kciwXvXrQkHg8NrSdSG779LLLS/o/L49

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.transotraval.cl
Port:
21
Username:
[email protected]
Password:
vIZ2P]dt&a!d

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4004 set thread context of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 set thread context of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 set thread context of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 set thread context of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 set thread context of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 set thread context of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 set thread context of 1504	4004	Order confirmation for PO 7UH2025.exe	95
PID 4004 set thread context of 4568	4004	Order confirmation for PO 7UH2025.exe	96
PID 4004 set thread context of 3584	4004	Order confirmation for PO 7UH2025.exe	98
PID 4004 set thread context of 2492	4004	Order confirmation for PO 7UH2025.exe	99
PID 4004 set thread context of 3296	4004	Order confirmation for PO 7UH2025.exe	100
PID 4004 set thread context of 2160	4004	Order confirmation for PO 7UH2025.exe	101
PID 4004 set thread context of 2760	4004	Order confirmation for PO 7UH2025.exe	102
PID 4004 set thread context of 968	4004	Order confirmation for PO 7UH2025.exe	103
PID 4004 set thread context of 232	4004	Order confirmation for PO 7UH2025.exe	105
PID 4004 set thread context of 2732	4004	Order confirmation for PO 7UH2025.exe	108
PID 4004 set thread context of 3480	4004	Order confirmation for PO 7UH2025.exe	110
PID 4004 set thread context of 4144	4004	Order confirmation for PO 7UH2025.exe	113
PID 4004 set thread context of 2460	4004	Order confirmation for PO 7UH2025.exe	114
PID 4004 set thread context of 3240	4004	Order confirmation for PO 7UH2025.exe	115
PID 4004 set thread context of 1512	4004	Order confirmation for PO 7UH2025.exe	116
PID 4004 set thread context of 3064	4004	Order confirmation for PO 7UH2025.exe	117
PID 4004 set thread context of 3776	4004	Order confirmation for PO 7UH2025.exe	120
PID 4004 set thread context of 4824	4004	Order confirmation for PO 7UH2025.exe	124
PID 4004 set thread context of 2440	4004	Order confirmation for PO 7UH2025.exe	126
PID 4004 set thread context of 2180	4004	Order confirmation for PO 7UH2025.exe	127
PID 4004 set thread context of 2604	4004	Order confirmation for PO 7UH2025.exe	128
PID 4004 set thread context of 3588	4004	Order confirmation for PO 7UH2025.exe	130
PID 4004 set thread context of 2532	4004	Order confirmation for PO 7UH2025.exe	131
PID 4004 set thread context of 4828	4004	Order confirmation for PO 7UH2025.exe	132
PID 4004 set thread context of 708	4004	Order confirmation for PO 7UH2025.exe	133
PID 4004 set thread context of 4008	4004	Order confirmation for PO 7UH2025.exe	134
PID 4004 set thread context of 2176	4004	Order confirmation for PO 7UH2025.exe	135
PID 4004 set thread context of 3484	4004	Order confirmation for PO 7UH2025.exe	136
PID 4004 set thread context of 3128	4004	Order confirmation for PO 7UH2025.exe	137
PID 4004 set thread context of 4304	4004	Order confirmation for PO 7UH2025.exe	138
PID 4004 set thread context of 1752	4004	Order confirmation for PO 7UH2025.exe	139
PID 4004 set thread context of 1600	4004	Order confirmation for PO 7UH2025.exe	140
PID 4004 set thread context of 3168	4004	Order confirmation for PO 7UH2025.exe	141
PID 4004 set thread context of 2548	4004	Order confirmation for PO 7UH2025.exe	142
PID 4004 set thread context of 2244	4004	Order confirmation for PO 7UH2025.exe	144
PID 4004 set thread context of 2912	4004	Order confirmation for PO 7UH2025.exe	145
PID 4004 set thread context of 2772	4004	Order confirmation for PO 7UH2025.exe	146
PID 4004 set thread context of 2092	4004	Order confirmation for PO 7UH2025.exe	147
PID 4004 set thread context of 2120	4004	Order confirmation for PO 7UH2025.exe	148
PID 4004 set thread context of 2640	4004	Order confirmation for PO 7UH2025.exe	149
PID 4004 set thread context of 5032	4004	Order confirmation for PO 7UH2025.exe	151
PID 4004 set thread context of 548	4004	Order confirmation for PO 7UH2025.exe	152
PID 4004 set thread context of 1520	4004	Order confirmation for PO 7UH2025.exe	153
PID 4004 set thread context of 4236	4004	Order confirmation for PO 7UH2025.exe	154
PID 4004 set thread context of 4952	4004	Order confirmation for PO 7UH2025.exe	155
PID 4004 set thread context of 4396	4004	Order confirmation for PO 7UH2025.exe	156
PID 4004 set thread context of 4880	4004	Order confirmation for PO 7UH2025.exe	157
PID 4004 set thread context of 4960	4004	Order confirmation for PO 7UH2025.exe	158
PID 4004 set thread context of 5068	4004	Order confirmation for PO 7UH2025.exe	159
PID 4004 set thread context of 1584	4004	Order confirmation for PO 7UH2025.exe	161
PID 4004 set thread context of 5040	4004	Order confirmation for PO 7UH2025.exe	162
PID 4004 set thread context of 3532	4004	Order confirmation for PO 7UH2025.exe	163
PID 4004 set thread context of 3988	4004	Order confirmation for PO 7UH2025.exe	165
PID 4004 set thread context of 1180	4004	Order confirmation for PO 7UH2025.exe	166
PID 4004 set thread context of 1020	4004	Order confirmation for PO 7UH2025.exe	170
PID 4004 set thread context of 2976	4004	Order confirmation for PO 7UH2025.exe	171
PID 4004 set thread context of 4528	4004	Order confirmation for PO 7UH2025.exe	172
PID 4004 set thread context of 3308	4004	Order confirmation for PO 7UH2025.exe	174

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4648	2732	WerFault.exe	108
3052	4496	WerFault.exe	94
1976	2160	WerFault.exe	101

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3584	AddInProcess32.exe
3584	AddInProcess32.exe
3584	AddInProcess32.exe
2620	AddInProcess32.exe
2620	AddInProcess32.exe
2620	AddInProcess32.exe
3732	installutil.exe
3732	installutil.exe
3732	installutil.exe
628	msbuild.exe
628	msbuild.exe
2604	AddInProcess32.exe
2604	AddInProcess32.exe
2176	AddInProcess32.exe
2176	AddInProcess32.exe
3168	AddInProcess32.exe
3168	AddInProcess32.exe
2244	installutil.exe
2244	installutil.exe
2120	AddInProcess32.exe
2120	AddInProcess32.exe
1520	AddInProcess32.exe
4236	AddInProcess32.exe
4236	AddInProcess32.exe
1520	AddInProcess32.exe
4960	AddInProcess32.exe
4960	AddInProcess32.exe
1584	installutil.exe
1584	installutil.exe
1180	AddInProcess32.exe
1180	AddInProcess32.exe
3308	installutil.exe
3308	installutil.exe
2260	AddInProcess32.exe
2260	AddInProcess32.exe
1020	regasm.exe
1020	regasm.exe
4428	AddInProcess32.exe
4428	AddInProcess32.exe
2828	installutil.exe
2828	installutil.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	AddInProcess32.exe
Token: SeDebugPrivilege	3584	AddInProcess32.exe
Token: SeDebugPrivilege	2620	AddInProcess32.exe
Token: SeDebugPrivilege	3732	installutil.exe
Token: SeDebugPrivilege	628	msbuild.exe
Token: SeDebugPrivilege	2604	AddInProcess32.exe
Token: SeDebugPrivilege	2176	AddInProcess32.exe
Token: SeDebugPrivilege	3168	AddInProcess32.exe
Token: SeDebugPrivilege	2244	installutil.exe
Token: SeDebugPrivilege	2120	AddInProcess32.exe
Token: SeDebugPrivilege	1520	AddInProcess32.exe
Token: SeDebugPrivilege	4236	AddInProcess32.exe
Token: SeDebugPrivilege	4960	AddInProcess32.exe
Token: SeDebugPrivilege	1584	installutil.exe
Token: SeDebugPrivilege	1180	AddInProcess32.exe
Token: SeDebugPrivilege	3308	installutil.exe
Token: SeDebugPrivilege	2260	AddInProcess32.exe
Token: SeDebugPrivilege	1020	regasm.exe
Token: SeDebugPrivilege	4428	AddInProcess32.exe
Token: SeDebugPrivilege	2828	installutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 2620	4004	Order confirmation for PO 7UH2025.exe	84
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4456	4004	Order confirmation for PO 7UH2025.exe	85
PID 4004 wrote to memory of 4204	4004	Order confirmation for PO 7UH2025.exe	86
PID 4004 wrote to memory of 4204	4004	Order confirmation for PO 7UH2025.exe	86
PID 4004 wrote to memory of 4204	4004	Order confirmation for PO 7UH2025.exe	86
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 3732	4004	Order confirmation for PO 7UH2025.exe	87
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 2256	4004	Order confirmation for PO 7UH2025.exe	88
PID 4004 wrote to memory of 3956	4004	Order confirmation for PO 7UH2025.exe	89
PID 4004 wrote to memory of 3956	4004	Order confirmation for PO 7UH2025.exe	89
PID 4004 wrote to memory of 3956	4004	Order confirmation for PO 7UH2025.exe	89
PID 4004 wrote to memory of 4176	4004	Order confirmation for PO 7UH2025.exe	90
PID 4004 wrote to memory of 4176	4004	Order confirmation for PO 7UH2025.exe	90
PID 4004 wrote to memory of 4176	4004	Order confirmation for PO 7UH2025.exe	90
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 628	4004	Order confirmation for PO 7UH2025.exe	91
PID 4004 wrote to memory of 4476	4004	Order confirmation for PO 7UH2025.exe	92
PID 4004 wrote to memory of 4476	4004	Order confirmation for PO 7UH2025.exe	92
PID 4004 wrote to memory of 4476	4004	Order confirmation for PO 7UH2025.exe	92
PID 4004 wrote to memory of 512	4004	Order confirmation for PO 7UH2025.exe	93
PID 4004 wrote to memory of 512	4004	Order confirmation for PO 7UH2025.exe	93
PID 4004 wrote to memory of 512	4004	Order confirmation for PO 7UH2025.exe	93
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 4496	4004	Order confirmation for PO 7UH2025.exe	94
PID 4004 wrote to memory of 1504	4004	Order confirmation for PO 7UH2025.exe	95

C:\Users\Admin\AppData\Local\Temp\Order confirmation for PO 7UH2025.exe
"C:\Users\Admin\AppData\Local\Temp\Order confirmation for PO 7UH2025.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:4176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 96
    3⤵
    - Program crash
    PID:3052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 88
    3⤵
    - Program crash
    PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:5024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 88
    3⤵
    - Program crash
    PID:4648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:4824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:1928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:3736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3296 -ip 3296
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4496 -ip 4496
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2160 -ip 2160
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2732 -ip 2732
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3240 -ip 3240
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2440 -ip 2440
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-18-0x0000000005CA0000-0x0000000006244000-memory.dmp

Filesize
5.6MB

Download
memory/2828-76-0x0000000006960000-0x00000000069B0000-memory.dmp

Filesize
320KB

Download
memory/2828-77-0x0000000006A50000-0x0000000006AE2000-memory.dmp

Filesize
584KB

Download
memory/2828-78-0x00000000069F0000-0x00000000069FA000-memory.dmp

Filesize
40KB

Download
memory/3732-24-0x0000000004E20000-0x0000000004E86000-memory.dmp

Filesize
408KB

Download